CapsRule: Explainable Deep Learning for Classifying Network Attacks.

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Machine Learning

Background:

• Deep learning (DL) models offer significant potential but lack transparency, hindering their adoption.
• Existing rule extraction methods for DL are often inefficient, incomprehensible, and not scalable for security applications.
• There is a need for explainable AI (XAI) methods optimized for network attack classification.

Purpose of the Study:

• To propose CapsRule, an effective and efficient rule-based DL explanation method for classifying network attacks.
• To extract high-fidelity rules from feed-forward capsule networks that elucidate classification decisions.
• To address limitations of existing methods concerning decision boundaries, data types, and dataset sizes in security contexts.

Main Methods:

• Developed CapsRule, a novel rule-based DL explanation method utilizing feed-forward capsule networks.
• Integrated rule extraction with the training phase using precomputed coupling coefficients for enhanced efficiency.
• Leveraged capsule activation vectors to represent semantic intelligence for rule generation.

Main Results:

• CapsRule generates accurate, high-fidelity, and comprehensible rules for network attack detection.
• Achieved 99.0% average accuracy and a 0.70% false positive rate for reflection- and exploitation-based attacks on the CICDDoS2019 dataset.
• Demonstrated that extracted rules approximate nonlinear decision boundaries, reduce false positives, increase transparency, and identify data errors.

Conclusions:

• CapsRule provides an effective and efficient solution for explainable AI in network attack classification.
• The method enhances transparency and accuracy, aiding in identifying and mitigating cyber threats.
• Learned features from CapsRule align with domain knowledge and help detect dataset flaws and erroneous attack patterns.